What problem does it solve? Open redirect findings are often dismissed as low severity, leaving testers unsure how to demonstrate real impact. This Skill provides a structured methodology to discover redirect parameters, bypass filters, and escalate findings into high-impact chains like OAuth authorization code theft leading to account takeover. ## Core Features & Use Cases - Redirect Parameter Discovery: Enumerates common redirect parameters (next, url, returnTo, callback, redirect_uri) from crawled URLs using gf patterns and grep. - Filter Bypass Payloads: Provides a bypass table covering protocol-relative URLs, backslash tricks, at-sign confusion, URL encoding, null bytes, and JavaScript/data URIs. - Impact Chaining: Maps open redirects to OAuth redirect_uri abuse for auth code theft, phishing with trusted domains, session fixation, and server-side redirect escalation to SSRF. - Use Case: During an authorized bug bounty engagement, you find /logout?returnTo= on the target. Use this Skill to test bypass payloads, confirm the Location header points to your controlled domain, then chain it into the OAuth flow to demonstrate ATO impact. ## Quick Start Use the hunt-open-redirect skill to test the redirect parameters found in my recon output for bypass techniques and OAuth chaining opportunities.
